News for hackers. Stuff that matters.

A comment on I Read the Entire Cybersecurity Executive Order; Here's What You Need to Know.

Re:I Read the Entire Cybersecurity Executive Order; Here's W... by grumblenum on Wednesday June 16, 2021 @12:58PM (#27530745)
How fortunate that an executive order was waiting in the wings, which requires federal contractors to purchase an authentication service and guarantee they use the underspecified ZTA (which will probably mean pay for AWS or Azure services to do anything at all), days after multiple highly-publicized million-dollar cybercrime heists were, quite astonishingly, thwarted by the FBI resulting in no money lost.
[ Parent | on HN ]
Re:I Read the Entire Cybersecurity Executive Order; Here's W... by meepmorp on Wednesday June 16, 2021 @01:35PM (#27531203)
Or, apparently, we can just use https://login.gov

(link from https://news.ycombinator.com/item?id=27530920)

[ Parent | on HN ]
Re:I Read the Entire Cybersecurity Executive Order; Here's W... by grumblenum on Wednesday June 16, 2021 @02:23PM (#27531765)
That appears to be for consumers of federal government web services, which I would not expect to prevent large breaches. The service itself would be a massive single point of failure, and I'm not sure how it would prove a contractor has ZTA, or whatever an administrator thinks that means, all the way down.
[ Parent | on HN ]
Re:I Read the Entire Cybersecurity Executive Order; Here's W... by toomuchtodo on Wednesday June 16, 2021 @03:59PM (#27532796)
It alone is not a silver bullet for ZTA, but authn and authz are critical components of ZTA. Most are not good at auth*, should not roll their own, and absolutely should delegate to a service that provides this functionality (commercially, you see this with Okta and Auth0, for example).
[ Parent | on HN ]
Re:I Read the Entire Cybersecurity Executive Order; Here's W... by pimlottc on Wednesday June 16, 2021 @04:04PM (#27532850)
While primarily targeted at the public, login.gov is used for some internal gov sites as well.
[ Parent | on HN ]
Re:I Read the Entire Cybersecurity Executive Order; Here's W... by ww2buff on Wednesday June 16, 2021 @05:21PM (#27533630)
What exactly is this pile of innuendo meant to allege
[ Parent | on HN ]
Re:I Read the Entire Cybersecurity Executive Order; Here's W... by grumblenum on Thursday June 17, 2021 @03:20PM (#27543429)
Since you asked, I'll make it explicit. My pile of innuendo alleges that the FBI is directly responsible or at least complicit for the Colonial Pipeline and JBM hacks, and the executive order is likely written by lobbyists who sell or intend to sell authentication services or "secure" platforms to federal contractors.

Do you remember back when there were no weapons of mass destruction and the "Intelligence Community", the media, and other agents of reputable institutions all went along with the lie so that unrelated geopolitical objectives could be satisfied and defense contractors would make insane amounts of money? It's like that.

[ Parent | on HN ]